The Therac-25 is a so-called linear accelerator (linac) , which was primarily used for the radiotherapy treatment of cancerous tumours in the 1980s. Although it was considered the most advanced device of its time, its use and widespread adoption remained limited, precisely because of the accidents that occurred. A total of just 11 units were built by AECL (Atomic Energy of Canada Limited); five machines were in operation in the United States and six in Canada. They were used in renowned oncology centres, including in Tyler, Texas; Yakima, Washington; and Hamilton, Canada.

The machine appeared to be much more efficient than earlier models (Therac-6, Therac-20) because, on the one hand, computerised control meant that technicians had to carry out fewer manual adjustments, allowing them to treat more patients in a single day; and secondly, thanks to new technology, the machine took up less space, making it cheaper to install in hospitals.

Therac-25 treatments were essentially carried out at two locations – the radiation-shielded treatment room and the external control room – in accordance with a strict protocol that was, however, expedited by the use of software.

First, the radiology technician positioned the patient on the treatment table and manually adjusted the machine’s gantry and the size of the irradiation field, as well as securing the necessary accessories. By setting the machine to ‘field light’ mode, a visible light was projected onto the patient using a mirror. This showed exactly where the (ideally) invisible beam would be directed.

The technician then left the shielded room and, using the external terminal (keyboard and monitor), entered the patient’s details and the treatment plan: the operating mode (electron or X-ray), the energy level and the dose. The software compared the data entered at the terminal with the machine’s mechanical settings. If they matched, the “VERIFIED” message appeared. Finally, the technician pressed the “Beam ON” button to start the treatment, which usually lasted 1–5 minutes.

Experienced operators handled the keypad extremely quickly and routinely. Occasionally, an operator would accidentally press X (X-ray mode), then instantly backtrack and correct this to E (electron mode). If this correction was made within 8 seconds, the software displayed the new mode, but (and this was not apparent to the operator) the machine’s internal mechanism (the rotary dial) did not switch over in time.

Although the equipment indicated the fault with the non-descript “Malfunction 54”, which stands for ‘dose input 2’ , this still gave even the specialists no indication of what the actual problem was. The manual provided to operators did not contain a list of error codes or any explanations. There was nothing to suggest that this message posed any risk to the patient.

When the Malfunction 54 appeared, the machine did not shut down in an emergency; instead, it merely ‘paused’ (Pause) the treatment. The operating staff understood that faults causing a pause were harmless (such as a minor voltage fluctuation), and that the procedure could simply be resumed by pressing the “P” (Proceed) button.

Next to the fault on the screen, the message ‘No dose’ (no dose), meaning the machine indicated that it had not yet delivered any radiation at all. The operator therefore pressed the ‘Proceed’ button with a clear conscience, so that the patient would receive the planned dose – whilst in reality, with every single press of the button, the machine was performing another lethal release of the safety latch.

The technicians saw as many as 40 similar error messages a day, most of which were indeed harmless. As a result, they developed a sort of ‘alarm fatigue’: they viewed Malfunction 54 as just one of many annoying but insignificant software glitches.

On several occasions, patients reported after their treatments that something was wrong. Ray Cox, one of the victims, described an “electric shock” and saw a bluish light flashing from the machine. However, the hospital staff did not believe them at first, as the monitor indicated that everything was proceeding perfectly normally.

When the hospital in Tyler first reported the problem to AECL, the manufacturer responded (rather arrogantly) by stating that there had never been a case of radiation overdose with the Therac-25. They claimed that the machine was safe in terms of both hardware and software, and attributed the fault to an electrical short circuit, but primarily to human error.

Therac-25

Fritz Hager, who works at the East Texas Cancer Centre , did not accept the manufacturer’s explanations. When, in April 1986, a second patient observed the same highly suspicious phenomena with the same technician, Hager resolved not to stop testing the machine until he had reproduced the phenomenon.

Hager and the technician spent hours and days trying out the machine, but it operated without fault. Eventually, they discovered the secret: the technician had to type as quickly as he usually did during his daily routine. When Hager managed to carry out the repair within 8 seconds, the machine finally displayed the infamous ‘Malfunction 54’ message.

Hager then attached measuring instruments to the bed, in the patient’s position, and was horrified to see that the machine was delivering a hundred times the intended dose. With this evidence in hand, the manufacturer could do nothing: they were forced to launch an internal investigation, and eventually had to admit to the software fault and report the incident to the FDA (U.S. Food and Drug Administration).

Hager realised that the manufacturer’s engineers had failed to spot the fault because they “with an engineer’s slowness”; they typed cautiously, whilst the technicians working their daily routine had their fingers practically flying over the keys, and the fault only occurred under such conditions.

Finally, during the investigation, it was analysed that the PDP-11 computer was running a real-time operating system that handled multiple tasks (tasks) simultaneously. In the software, processing data from the keyboard and physically adjusting the machine (such as rotating the disc) were two separate processes.

When the operator switched from X-ray mode to Electron mode, the software initiated a process to move the dial. However, if the operator made the correction within 8 seconds, part of the software had already recognised the new data, but the part responsible for the machine’s physical settings was still operating in the old state. The machine believed everything was ready, but in fact it emitted the enormous amount of radiation required for X-ray mode onto the patient.

===== Consequences =====The Therac-25 tragedy fundamentally shook the foundations of medical device regulation and the ethics of software development.

Several survivors and the families of those who died brought compensation claims against AECL and the hospitals where the treatment was carried out. The parties eventually reached out-of-court settlements in all cases, so the exact amounts of the compensation were never made public.

In 1987, the US Food and Drug Administration (FDA) declared the equipment to be defective and ordered all Therac-25 machines to be taken out of service until the manufacturer had carried out the necessary modifications.

More than 20 modifications were eventually made to the machines, including the installation of mechanical safety interlocks – which had previously been omitted – capable of stopping the radiation independently of the software. Following the incident, hospitals were required to report all serious accidents to the authorities. Previously, manufacturers had been able to conceal faults, meaning that different hospitals were unaware of incidents at other hospitals.

Therac-25 diagram, Source: createdigital.org.au / Diagram adapted from Leveson (1995)

The software developer was never publicly named. Investigations revealed that the entire control software had been written by a single person, in PDP-11 assembly language. During subsequent court proceedings, the defence lawyers were also unable to identify the programmer, nor could they ascertain anything about his qualifications or previous experience. All that is known is that the programmer left AECL in 1986 – before the full extent of the scandal had come to light.

Since then, the Therac-25 has become a ‘textbook case’ a “textbook example” in software engineering training: it is used to illustrate that overconfidence, blind trust in software and the neglect of independent safety systems can cost lives.

Fritz Hager is still alive, although he has kept out of the public eye since the events of the 1980s. He recently (at the end of 2024) spoke in a professional interview, in which he once again recalled the events surrounding the Therac-25. He continues to believe it is important for future software engineers to learn from the mistakes of the past.

In a recent publication, he stated that the Therac-25 incidents are unique in the history of radiotherapy, and that it is important for these “are learnt in the classroom, rather than at the cost of human lives”. Without the physicist’s determination, there would likely have been even more victims of the faulty software, as the manufacturer (AECL) denied all allegations in the face of his overwhelming evidence.

cs.columbia.edu - therac25.pdf
en.wikipedia.org - Therac-25
ethicsunwrapped.utexas.edu - case-study/therac-25
utsouthwestern.elsevierpure.com - Therac 25 incidents
de.wikipedia.org - Therac-25
smartbear.com - Bug Day race condition Therac-25
worldhealthexpo.com - The deadly case of the Therac-25: a warning for medical AI
onlineethics.org - A History of the Introduction and Shut Down of the Therac-25
ethicsunwrapped.utexas.edu - Therac-25
w3.cs.jmu.edu - 2004-JMU-Therac.pdf

Similar posts can be found at ‘Interesting Stories’ section:

Number of post views: total